AAIR Renewal and Retakes Explained

The short version

Yes, AAIR is a credential you have to keep up. ISACA’s maintenance page asks holders to report at least 10 hours of AAIR-related continuing professional education (CPE) every year, and at least 30 hours in each three-year period, plus an annual maintenance fee. The exam itself can be retaken up to four times in a rolling 12 months, with waits between attempts. This page follows ISACA’s pages and AAIR candidate guide, checked on October 22, 2026. ISACA can change these rules, so confirm them before you plan around them.

Two different things: the exam and the credential

People mix these up, so keep them apart.

The exam is a one-time event. Passing it does not make you a holder yet.
The credential starts when you apply after passing, and it stays active only while you meet the maintenance rules.

You have five years from your pass to apply. If you let that window close, you cannot simply apply with the old result. That is why it helps to apply soon after you pass.

How retakes work

The candidate guide sets a clear ladder.

Attempt	Wait before it
1st	None
2nd	At least 30 days after the first
3rd	At least 90 days after the second
4th	At least 90 days after the third

You get at most four attempts in a rolling 12-month period, counted from your first attempt. You register and pay for each attempt separately. We do not list fees, because ISACA sets them and changes them.

Two more retake rules matter:

You cannot retake the exam after you pass it while you hold the credential.
You also cannot retake a passed exam during the five-year application period.

The guide does not say what happens after a fourth failed attempt beyond the 12-month limit. Read it as: after the rolling year ends, the count resets. If that matters to you, ask ISACA to confirm.

A practical point: the 30- and 90-day waits are long. Do not book a second attempt in a hurry. Use the gap to look at your domain results, which ISACA provides for information only, and rebuild the weakest area. The study plan has a domain-by-domain schedule you can reuse.

What keeping the credential involves

Once you hold AAIR, ISACA’s maintenance page lists these duties.

Annual CPE. Report at least 10 CPE hours each year, and they must relate to AAIR knowledge or tasks. ISACA’s application page says reporting starts in the calendar year after you earn the credential.
Three-year total. Across each three-year reporting period, you need at least 30 AAIR-related hours. The yearly 10 hours and the 30-hour total work together, so a big year does not excuse empty ones.
Annual maintenance fee. It is due by January 1 each year and renews the credential through that calendar year. Invoices start in the autumn before. We do not print amounts.
Ethics. Holders follow ISACA’s Code of Professional Ethics.
Prerequisite credential. The application page says to keep your qualifying credential active. The maintenance page does not list prerequisite credentials, so check how ISACA applies this to you.

ISACA says CPE hours can count toward more than one ISACA credential when the activity fits the job knowledge of each. If you already hold CRISC or CISM, one good course can serve two reporting requirements. Check that the topic really fits each one.

Audits

ISACA picks some holders at random for a CPE audit. If you are picked, you must document all activity you reported for a specific calendar year. Keep records for 12 months after each three-year cycle ends. Each record should show who attended, the sponsor, the title, a description, the date, and the hours. A certificate and a short note on content is a simple habit that makes this painless.

If the credential lapses

ISACA says failure to meet the requirements leads to revocation of the AAIR designation. A revoked holder must stop claiming the credential and is reported as revoked when someone verifies the credential.

There is a road back. You can appeal in writing to the AAIR Working Group with an explanation and your CPE documentation from the revocation period to now. If ISACA approves, you pay the unpaid maintenance fees and a reinstatement fee. If it denies the appeal, you must pass the exam again and reapply.

ISACA also offers Non-Practicing and Retired statuses for people who qualify. Details are on its maintenance page.

When the exam changes or is retired

ISACA’s AAIR pages do not publish a retirement date, a version-change schedule, or a rule for how long a pass remains valid after the outline changes. The exam is new, and the guide shows a 2026 copyright with no issue date. So we cannot tell you when the outline will be updated. What we can say: your five-year application window starts at your pass date, so a later outline change does not shorten it as far as ISACA’s pages say.

A timeline example

This is an illustration, not an ISACA schedule.

March: you pass the exam.
April: you apply and pay the application fee. Your credential becomes active.
Next January 1: your first calendar year of CPE reporting begins.
Each year: you log at least 10 AI-risk hours and pay the maintenance fee by January 1.
After three years: your total is at least 30 hours.

Frequently asked questions

Does AAIR expire?

It stays active only while you meet CPE, fee, and ethics rules. Missing them leads to revocation.

How long do I wait to retake it?

At least 30 days after the first attempt, then 90 days after the second and again after the third.

Do I need to retake the exam to renew?

No. ISACA’s maintenance page describes renewal through CPE and fees, not a new exam.

More guides for AAIR

Next step

Read the exam format page for the full scoring and booking rules, and the AAIR overview for the big picture. If you want a clock-based check before your first attempt, the AAIR practice exams are there when you need them.

Try these practice exams